OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

CRITICO 10.0CVE-2026-41900 · GHSA-8h25-q488-4hxw · Published 08/05/2026 · updated 26/10/2026

In breve

CVE-2026-41900 è una vulnerabilità CRITICO (CVSS 10.0) che riguarda openlearnx (th30d4y), openlearnx.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.91%, superiore al 60.0% delle vulnerabilità.
Correzione: aggiornare a 2.0.3 o successiva.

Package	Affected versions	Patched versions
openlearnx th30d4y	`= 2.0.1`	No fix yet
openlearnx npm	`< 2.0.3`	`2.0.3`

Description

Overview

A critical Remote Code Execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. The issue has been fixed.

NVD description

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. This issue has been patched in version 2.0.3.

References

th30d4y/OpenLearnX security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-41900 · ADVISORY
th30d4y/OpenLearnX commit 14765d7 · WEB
th30d4y/OpenLearnX · PACKAGE
th30d4y/OpenLearnX release v2.0.3-security-fix · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free